Malicious npm package targets Twilio developers with data-harvesting attempts

The package, published by an now-deleted npm account, initially presented itself as an authorized bug-bounty probe for Twilio's HackerOne program.